Soon you will see people saying you should have done this or that complicated thing, or how somebody so smart could should have known better.
No matter what they say it is never enough. This is why lack of consumer protections suck.
This is my opinion of the entire software industry.
Chrome exploits, iPhone hacks, etc. These are nearly trillion dollar companies. If they can't do it then nobody can. Something is fundamentally broken.
People have touted capability-based security, but I don't think that's the answer, at least for consumer devices (phones and not-administered-by-IT computers). Users will give an app whatever permissions it asks for in order for it to shut up and start running, and those permissions will be used to gut their security. It may limit the damage somewhat, depending on how disciplined the app and the user are, but it will only reduce the damage.
We need a completely different answer. I don't know what it is.
As another poster said, we need some other computing paradigm, but I don't know what that would look like. All I know is something is broken if these behemoth companies with limitless resources still get it wrong.
Yes, Qubes does not solve the problems like Spectre and Meltdown. Yes, you must trust your hardware to use it. If you are looking to solve such problem, then you might be interested in a stateless laptop: https://blog.invisiblethings.org/papers/2015/state_harmful.p....
Apart from that, I believe, the best computing paradigm is free software and free hardware, but it does not seem too widespread now unfortunately. This would be the actual solution. The "behemoth companies" are not trying to solve computer security. They are trying to get as much profit as possible, and it goes against security of the users. This is why they are not supporting free software.
My current "good enough" solutions are disabled and neutralized ME in a laptop and Librem 5 phone.
A lot of hope, actually. If he followed the simple and oft repeated advice of using a cold wallet and/or offline computer, this attacked would have been mitigated. Hell, if some of the comments/speculation in this thread is true (ie. he kept his wallet.dat on a server connected to the internet), then this hack wouldn't have affected the user with the most basic setup of a software wallet running on a computer behind a NAT firewall.
Every random walk down the timeline results in 100% of coins lost or stolen.
[edit] You can only blame the user so many times before you have to really look inward haha.
Anyways those doing the foisting also includes all the shills, the laser-eyed, the influencers. [edit] It's not enough to say because they weren't forced at gunpoint, it's not coercive or immoral. We don't accept that behavior from people shilling penny stocks. And of course Salvadoran shopowners were in fact coerced with force.
Sure, there are institutional investors holding crypto, but how is this related to the current discussion of securing crypto? They're not exactly keeping their crypto holdings in a software wallet connected to the internet. They typically outsource that to companies that specialize in crypto custody, which presumably have better security practices than the OP.
It preys of financially illiterate people who don't know better because they have been bombarded without any pause by endless list of bullshit as soon as they put the word 'investment', 'money', 'market' or whatever in any search box in the world, that being the one from your local bookstore, online newspapers, youtube, google, reddit and on and on and on...
And if you tell me fractional banking system is a ponzi scheme then you either don't have a clue of what they are or you pretend to.
It doesn't matter which companies, individuals or wathever .org or 'coin something' websites promote them or make a business of them because they're all fucking hucksters at worst or paid shills at best.
Talking 'security' about investment scams is like talking personnal safety in '101 suicide' book.
Except in this case, it seems like he went out of his way to make it less secure, by putting his wallet on his server. This isn't a case of someone losing his mattress savings in a random home burglary, this is a case of someone leaving a duffle bag of cash in the seat of a car.
I mean this guy is already demanding the FBI get involved when the FBI's position is you should just put it in a bank account and not need to call us in the first place.
https://www.newyorker.com/humor/daily-shouts/l-p-d-libertari...
I think you're conflating "someone who is defending crypto in this particular instance" with "someone who thinks bitcoin will take over the world".
>I mean this guy is already demanding the FBI get involved when the FBI's position is you should just put it in a bank account and not need to call us in the first place.
Yeah, I think we're in agreement here that he was acting like an idiot.
We've talked a few times, I always appreciate your perspective :)
But even if that weren't true, that doesn't mean its a good idea to use it or advocate for it or pretend it doesn't have these glaring flaws as folks march onward toward the abyss and take down the normies with them.
It's everyone's responsibility to call out bad ideas that harm us all. Especially when as soon as anything goes wrong, the afflicted yell "HELP! POLICE!!" just like our tweeter down-thread. That's a draw on public resources which puts this discourse squarely in the public interest. Not to mention spending like 0.6% of the world's electricity on coal-powered lotto ticket scratcher machines undergirding the whole charade.
The worst part is when things start to go wrong all the talking heads jump in and start saying "nobody could have seen this coming!!" and "crypto deserves better critics!!" It has fantastic critics - you just have to listen. Critics aren't supposed to say things you want to hear.
Your average user will install whatever crap they find on the Internet. Hell, a friend of mine (in their 20s, not a grandma) recently installed god knows what when “Windows support” called. And it’s not the first time a friend fell for this kind of scam.
[1] https://twitter.com/peterktodd/status/1609655629903265795
Agreed, and the problem is that this is a feature. Without that feature of a lack of central control, Bitcoin's main use case is invalid.
Internet security is 99% "nobody gives enough damn to do it".
So, rather than the consumer being responsible for their actions you support consumers engaging in whatever risky behavior they like as long as someone else is there to protect them or give them a do-over?
Then again, the point the GP seems to make is that this kind of platform should not be adopted for anything important, let the gamblers gamble if they want but don't try to sell it to the general public.
Yes. Every time you make a foolproof system the world brings us a bigger fool. I'd rather a few irresponsible people get a do-over than otherwise responsible people getting rekt like this.
That's unreasonable for something that's supposed to be used as money
There is a big middle ground between "cover for users engaging in whatever risky behavior they like" and "cover for nothing whatsoever".
In this case, the problem is expecting users to be perfectly diligent, and either discard all convenience or all security.
Cryptocurrency continues to be a case study demonstrating why so many of the systems it's trying (unsuccessfully) to replace operate in ways that it doesn't.
Like in the non-crypto world, banks are the experts on storing money securely, but people still try and rob banks despite ordinary people being much easier targets.
cryptocurrency is stupid. regulation around banks is there for many very good reasons.
https://twitter.com/peterktodd/status/1609655629903265795
you won’t trust highly regulated banks, but you will trust random strangers on the internet whom you know want your wallet and all the coins in it, without any guarantees whatsoever that any security is in place. you only need to trust yourself, which is already 8-10 orders of magnitude less trustworthy than a bank, AT BEST.
even in the rare event that an established bank does go under, and it holds some of your money when it does, FDIC insurance will get you at least some of that money back. cryptocurrency has zero recourse if you are harmed.
i laugh when cryptobros and NFTbros lose money, because anyone with any critical thinking skills whatsoever saw these things as shams at the outset, and we tried to speak up, but none of those who have lost money even considered listening at the time.
it is hilarious to me when these things happen. i actually, literally, laugh out loud, without a single hint of remorse.
Do we know that? The tweet you linked to basically says, we have no idea what happened so we have no idea if it was targeted or not.
But i do agree generally that i have no idea why "imagine the financial system but with no regulation or oversight" is considered a selling point.
He might be a bitcoin core Dev but does he use ledger/trezor etc?
Is his PGP key on his hardrive or a smartcard?
In this day and age your computer not a bastion it once was. (It never really was but it's more of a problem in 2022 than 1982).
The system needs to be tolerant of failures and faults of multiple natures. And cryptocurrency is very intolerant or many types of failures and faults.
So why is crypto the only thing getting attention?
> Soon you will see people saying you should have done this or that complicated thing
and you answer:
> Is his PGP key on his hardrive or a smartcard?
you're proving their point.
I would assume that if you are a major player in the bitcoin world, you should do complicated things to secure yourself.
Its sort of like if someone wins the lottery, and tells the world they are putting the money under their mattress in their home. Its not unreasonable to say that such a person faces more risk than an ordinary person and should install an alarm system or something.
The Bitcoin model is broken. It very intentionally got rid of all the institutions that regulate and control finance, and in doing so, it got rid of everything that protects regular people from the wolves. The regular people aren't up to the task of protecting themselves, and they regularly show it. The model is broken.
But to the specific point, there is no model that fully takes this into account. There is no model that puts risk to zero. There will always be adversaries that can attack you if the payoff is large enough. There will always be people with increased risk exposure who have to take special precautions because the effort/reward calculus makes sense for malicious people to attack them.
The reason bitcoin sucks is not because its model includes such situations; it sucks because the bar for someone to be the type of person who has to care about such things in bitcoin is so much lower than in traditional banking.
If you don't take up the easy convenient solution to your problem that's on you.
Hopefully this is a starting red flag for the bitcoin Dev team to implement hardware wallet support.
That's the absurd confirmation bias going on in this thread.
Cryptos piffy catchphrase is be your own bank. you can own security far beyond a bank vault for like £40 if you get a ledger nano...